 
 (defrecord CompositeDisjunctiveRequestAuthenticator [delegates]
   HttpRequestAuthenticator
-  (allowed-request? [_ request]
-    (some #(allowed-request? % request) delegates)))
+  (authenticate-request [_ request]
+    (some #(authenticate-request % request) delegates)))
 
 (defn new-composite-disjunctive-request-authenticator [& delegates]
   (->CompositeDisjunctiveRequestAuthenticator (s/validate [(s/protocol HttpRequestAuthenticator)] delegates)))

that authentication fails."
  ([h authenticator failure-handler]
     (fn [req]
       (let [auth (allowed-request? authenticator req)]
         (cond auth (h (merge req auth))
               failure-handler (failed-authentication failure-handler req)
               ;; Continue without merging auth


(defrecord SessionBasedRequestAuthenticator [http-session-store user-roles]
  HttpRequestAuthenticator
  (authenticate-request [_ request]
    (when-let [session (get-session http-session-store (:cookies (cookies-request request)))]
      {:session session ; retain compatibility with Ring's wrap-session
       ::session session
